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ABSTRACT: The Java and ActiveX programming languages offer a range of 
individual benefits that are attracting support from different factions 
within the computing industry, but the technologies are best used when 
deployed in specific environments. Financial systems integrators support 
Java's technological advantages in cross-platform computing, but many 
suggest that the technology is presently too immature and inadequately 
understood to be fully useful. The technology behind ActiveX is more fully 
understood by the majority of working developers, but the fact that ActiveX 
is designed for use in environments running Microsoft's Windows platform 
alienates some systems integrators. Companies already running Unix and 
associated technologies are likely to support Java, whereas firms that are 
committed to Windows are more likely to opt for ActiveX. 

TEXT: 

Financial institutions that are flocking to use Sun Microsystem's Java 
tout its portability but criticize its immaturity and while there are more 
developers with knowledge of ActiveX tools, its exclusivity to Microsoft is 
a problem. 

As the national debate on the relative benefits of two mobile 
computing languages, Java and ActiveX, swings back and forth in newspapers, 
magazines and Internet bulletin boards, financial systems technologists are 
quietly conducting their own tests and coming to their own conclusions. 

The consensus, among those who have experimented with the two systems, 
is that the debate isn't simply about one system usurping the role of 
another . 

Sun Microsystem's Java language versus Microsoft Corp.'s ActiveX 
system is about the exploration of tantalizing new opportunities versus the 
reliance on more mature, and thus perceived as more stable, technology. 

ActiveX and Java are two different types of portable code that are 
being used to integrate live content, graphics and animation into 
applications for deployment in network computing. 

The majority of users who talked to Wall Street & Technology and who 
have experimented with the two languages say that it's a mistake to portray 
one as "better" than another, often for the reason that the languages 
usually serve their purposes in a variety of different situations. In 
general, firms say Java is a good way to reach out to places they had a 
hard — and expensive time reaching before. Conversely, ActiveX is often 
used for applications running in existing Windows environments. 

For example, two leaders who are spearheading the Java development 
efforts at BankBoston are pinning their hopes on Java's ability to run 
across worldwide intranets and extranets. 

The developers, whose efforts mirror many others on Wall Street, want 
to use Java to help the firm save money at the same time it beefs up the 
capabilities of their global operations. 

"We have a group of about 15 to 20 Unix system administrators 
supporting this environment, not to mention the equipment, the consulting 



and the market 'data and everything else," says Mike Siegenfeld, director of 
•the derivatives and emerging markets systems at BankBoston's global capital 
markets group. 

"We're looking for a way to do that more cheaply so that we can have 
all our resources in one place here, " he says. 

Siegenfeld and Pam Haller, the head developer for the emerging markets 
applications, are working on rolling out an emerging markets Java applet 
called Emgraph in all of the group's offices in Singapore, Mexico City and 
Seoul, South Korea by the end of the year. Almost 20 traders in both Boston 
and London already use the system, which was up and running on those 
trading floors this past April. 

The Java applets should allow both the traders in these remote offices 
and clients to access financial engineering applications written in The 
Mathworks, Inc.'s Matlab software through an extranet or an intranet. 

The plan is to provide global access to BankBoston's proprietary 
historical analytics through applets on the intranet. The system will use 
the Unix-based messaging middleware Corba to link up to servers in Boston, 
where the hardcore number crunching is done with the more powerful C+ + 
code . 

Following the successful deployment of the infrastructure, Haller says 
BankBoston plans on upgrading the system to handle real-time analytics. 

"This is an example of how we're using Java and the Internet to 
basically gain a global application capability without having a global 
infrastructure -- it's a thin client design, which is an overused word, but 
it works," Siegenfeld comments. 

One important problem that Java should solve for BankBoston is that of 
deploying such complex programs across a smorgasbord of operating systems 
across the world, says Siegenfeld. BankBoston uses a variety of Unix-based 
Sun workstations at its headquarters but its overseas offices rely on PCs. 

Once this analytics system is up and running, Siegenfeld and Haller 
plan on implementing derivatives and emerging market bond trading 
capabilities on the same system, either by the end of the year or by the 
first quarter of next year. Ultimately, the two hope that this system will 
allow the firm to route all the back office duties resulting from these 
transactions to their Boston headquarters. 

"We're hoping that the entire bank can use a single back office based 
in Boston to support our entire organization," Siegenfeld says. 

Although Siegenfeld says that he's had "heated discussions," within 
his firm about Java and ActiveX, the latter was never even considered an 
option because of BankBoston's reliance on Unix. 

But Siegenfeld says he never would have considered ActiveX anyway 
because the whole point of being able to reach out without having to worry 
about the end-users' operating system and local support would have been 
lost. 

Most other securities firms like Java for the same reason of 
portability, say financial technology consultants. Other object-oriented 
languages, namely C++, which have similar properties, are more powerful, 
more mature and well documented but don't feature this crucial element. In 
addition, ActiveX components are more widely used for Windows applications, 
they say. 

"ActiveX is more oriented toward gluing desktops together so that I 
can write applications that pump things off my desktop onto yours," says 
Dr. Andrew Herbert, head of a European research team on distributed systems 
technology and a chief technology officer at Digitivity, Inc., a network 
management firm in Los Altos, Calif, and Cambridge, England. 

But Java is more often used in conjunction with Corba to link servers, 
Herbert notes. 

"What you find people doing is gluing their desktops together with 
ActiveX, connecting from their desktops to their back office servers using 
Corba and then gluing their servers together with Corba (as well,) so 
they're using a hybrid approach," he says. 

The consulting firm Fusion Systems Group, Inc., which operates a Sun 
designated Object Reality Center and consults with BankBoston, has actually 
helped financial firms integrate such Java-related and ActiveX systems, 
says Steve Siegal, the firm's managing director. The point is not to anchor 
the systems to ActiveX. 



- v "It ,% s important to understand that the Java/Corba model includes 
'ActiveX as a technology that they're happy to work with -- but ActiveX is 
exclusionary, so if you base your architecture on ActiveX, you limit your 
choices," says Siegal. 
^ Michael Synnott, an equities and futures trading support technologist 

in Merrill Lynch & Co.'s London office, agrees: "If you do use ActiveX, you 
are bolted into Microsoft — end of story." 

Synnott was recently part of a team that had to decide whether to use 
Java or ActiveX for the foundation of an internal application. The team 
ended up choosing Java. 

The decision was based on the amount of support that the ActiveX 
components would have required compared to the Java applets, Synnott says. 
After performing some stress-testing, the team found that Java required 
fewer lines of source code than ActiveX. 

In addition, the ActiveX solution required Merrill to install class 
libraries on every end-user's workstation, unlike Java applets, which only 
had to be installed on a central server. 

But Synnot intends to continue to use ActiveX controls to write the 
graphical front-ends for some of the trading desk's financial analytics 
systems. He finds that ActiveX can often be a more palatable solution 
because more tools are available. Others will for now choose this route for 
the same reasons, he predicts. 

"At the moment, a lot of people will shy away from Java because you've 
got very few people who've got any great knowledge of it and who are going 
to support it afterwards," he says, but BankBoston's Siegenfeld countered 
this problem by hiring C++ programmers who he then has trained in Java. 
Seven programmers have been trained through intensive workshops that can 
take up to a month, he says. Six more remain to be trained. 

The number of tools available and their reliability were certainly 
concerns for the developers of DLJ Direct, formerly known as PC Financial 
Network, says Suresh Kumar, DLJ Direct 's chief technology officer. 

Where the features of Java seemed to offer BankBoston solutions, it 
seems to do the opposite for DLJ Direct' s on-line trading system. 

The on-line brokerage, which has more than 352,000 accounts, went the 
other direction from the open systems on the Web this May when it gave its 
frequent traders the additional option of trading through a test version of 
its proprietary Windows-based front-end system. The firm bought ActiveX 
tools for the system's animation and charting features. 

Kumar says that HTML was too cumbersome and Java is still too 
immature . 

"There are charting tools available for Java, but Windows has been 
around longer than Java," Kumar says. "The charting package that we use is 
version five but with Java, it's likely to be version one." 

Another consideration was Java's limited functionality. 

With ActiveX, "we can take advantage of the caching information as 
well as going to our own middleware to make the transactions faster — for 
example, if somebody got a chart at 4:15 and they go back and ask for the 
same chart at five o'clock, why should they go back to the server? In Java, 
since you have no control over access to the local machine, you 
can't do that," he says. 

"The other thing is that every time you access Java, it has to 
download the code as well as the data, whereas with ActiveX you download it 
once and you don't have to get the code again." 

For Kumar, the more mature off-the-shelf ActiveX tools were a cheaper 
and more reliable alternative to both the problems of immature Java tools 
and a team of expensive Java programmers. 

Sun says it is working on several new initiatives that will improve 
Java's widely publicized performance problems. For now, however, 
developers, including BankBoston's Siegenfeld, admit that performance is 
still an issue, which is why firms typically run Java clients with C++ 
servers backing them up. 

"There aren't a lot of huge applets that people are using on a day to 
day basis," currently due to a number of performance-based problems, notes 
David Osborne, managing director of a New York-based consulting firm Micro 
Modeling Associates. 

Network Design Should be Part of Security Solution, Say Experts 



_ > By now, the stories of the security hazards associated with Java 
"applets and ActiveX components are legion. 

And as financial firms launch into doing business through these new 
systems, they must also address the widely reported security issues, which 
are most commonly buggy applets that might damage an end-user's hard drive. 

For a vivid demonstration of what Microsoft Corp.'s ActiveX is capable 
of, users could go to a site called the "Exploder," at 

http://www.halcyon.com/mclain/ActiveX/. The site, which is a demonstration 
designed by a computer consultant, contains an ActiveX component that if 
downloaded shuts down Windows 95 users' computers. 

Another site to check out is Sun Microsystems 1 subsidiary Javasoft's 
security pages at: http://java.sun.com/sfaq/which catalogues a long list of 
security bugs and fixes associated with the Java Development Kit 1.1. 

Experts say that firms that plan on including mobile code such as Java 
and ActiveX in their forays into the world of electronic commerce should 
have their security policy built into their network — rather than sticking 
it on afterwards like a bandage. 

Digital signatures, firewalls, and other individual approaches to the 
issue of network security are piecemeal attempts to solve a mult i- faceted 
problem, they say. 

"People should think of the overall security architecture of their 
system," says Marianne Mueller, an engineer at Javasoft, "because it's 
often the interaction of components that can lead to interesting 
loopholes . " 

That means that firewall solutions should only make up one part of a 
larger security policy. 

Firewall vendors' have typically offered two types of solutions. One 
is to completely block mobile code, such as Java and ActiveX, from entering 
a firm's internal network and the other is to apply a virus-like scan to 
incoming code that check for patterns that might reveal a malicious 
application . 

"I haven't seen products that 'solve 1 the problem," Mueller says. 

One new product introduced this June called "The Cage" aims to tackle 
these problems by adopting the network architecture approach. 

The Cage is a network architecture system that routes all an 
enterprise's incoming applets to a server with a Java virtual machine. The 
server acts as a "cage" that isolates the mobile code. End-users 
access the actual applet on the server through a "proxy 
applet," which is installed on their desktop. Their hard drives are 
therefore protected from any malicious or faulty code, according to Dr. 
Andrew Herbert, chief technology officer at the network management firm 
Digitivity, Inc., which has offices both in Los Altos, Calif, and 
Cambridge, England. 

The system grew out of a project based at the London offices of the 
investment bank SBC Warburg that was specifically designed to deal with 
applets, although it could be used for other types of code, says Herbert. 

SBC Warburg was pressed to find a solution because it had been 
receiving angry responses from its trading partners, Herbert says. 

"Stockbrokers discovered that Swiss Bank had a policy of not letting 
Java cross its firewall," he says. "They therefore said to Swiss Bank "Why 
should I run your Java when you won't run mine?" 

SBC Warburg is an investment banking subsidiary of Swiss Bank. The 
investment bank has started a pilot project that replaces its internal 
existing front-end client applications for trading with Java, says Herbert, 
and has also started to use Java to trade with its clients. 
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